[BUGFIX] Correct clickjacking header in backend